Trojan

Trojan.Zbot.INE malicious file

Malware Removal

The Trojan.Zbot.INE is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan.Zbot.INE virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Guard pages use detected – possible anti-debugging.
  • A process attempted to delay the analysis task.
  • Dynamic (imported) function loading detected
  • Enumerates running processes
  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Attempts to remove evidence of file being downloaded from the Internet
  • Behavioural detection: Injection (Process Hollowing)
  • Executed a process and injected code into it, probably while unpacking
  • Behavioural detection: Injection (inter-process)
  • Behavioural detection: Transacted Hollowing
  • Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
  • Created a process from a suspicious location
  • Installs itself for autorun at Windows startup
  • Exhibits possible ransomware file modification behavior
  • Creates a hidden or system file
  • Detects Bochs through the presence of a registry key
  • Creates a copy of itself
  • Harvests cookies for information gathering
  • Collects information to fingerprint the system
  • Clears web history

How to determine Trojan.Zbot.INE?


File Info:

name: BE62854618491CB4FE30.mlw
path: /opt/CAPEv2/storage/binaries/4b747f699cdab219152094dd541ebcb6da7e47bbcc8fb33b226b0013d4c7d7f2
crc32: 29A6AE8E
md5: be62854618491cb4fe30b2299102bb1b
sha1: 9eefa9228fef11bd0ee3d064f06ab3a91667edcd
sha256: 4b747f699cdab219152094dd541ebcb6da7e47bbcc8fb33b226b0013d4c7d7f2
sha512: 6088d33d9871ee8c1e8d01f18466ca86a21cf89d892dc6f5d07a5dc0eea2dafc570a86352c0b151fd22e471d2f38ccfacca832e40228f2d1f7d3b9e5afb67cb7
ssdeep: 24576:uf1H2XHc6gL75XqyHlXv0L5U+u2C8ZfVLgBdJbREOzdwIgcy9ldmLdGxnPKLnMxp:ufkclLdfKZfByRdsirDc
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1708523117E6B4F25C45C103DE0DF691803B44F82DABBE37B7A94749F022ABD26D9B498
sha3_384: 578a94d7a13658d21522a262416d0133ed74ac33c4c97ab60ca8b3ed77b656a28eeeb9e4188100abfa3698446df11af0
ep_bytes: ff250020400000000000000000000000
timestamp: 2014-11-21 08:46:54

Version Info:

FileDescription: Adobe Acrobat Documents
FileVersion:
InternalName:
LegalCopyright: Copyright © 2014
OriginalFilename:
ProductVersion:
Assembly Version:
Translation: 0x0000 0x04b0

Trojan.Zbot.INE also known as:

BkavW32.RansomwareOnion.Trojan
LionicTrojan.Win32.Generic.4!c
tehtrisGeneric.Malware
MicroWorld-eScanTrojan.Zbot.INE
FireEyeGeneric.mg.be62854618491cb4
McAfeeRansom-FQQ!BE6285461849
CylanceUnsafe
SangforSuspicious.Win32.Save.a
K7AntiVirusTrojan ( 700000121 )
BitDefenderTrojan.Zbot.INE
K7GWTrojan ( 700000121 )
CrowdStrikewin/malicious_confidence_100% (W)
BitDefenderThetaGen:NN.ZemsilF.34742.Ur0@aesLEwf
VirITTrojan.Win32.MSIL5.BRDK
CyrenW32/Risk.GUDZ-1681
Elasticmalicious (high confidence)
ESET-NOD32a variant of MSIL/Injector.GBU
TrendMicro-HouseCallTROJ_CRYPCTB.YUY
Paloaltogeneric.ml
CynetMalicious (score: 99)
KasperskyHEUR:Trojan.Win32.Generic
AlibabaTrojan:MSIL/Injector.0fb8f21c
NANO-AntivirusTrojan.Win32.Inject1.djeqei
ViRobotTrojan.Win32.Z.Injector.1807360
TencentMalware.Win32.Gencirc.114ccd4b
Ad-AwareTrojan.Zbot.INE
SophosMal/Generic-R + Troj/MSIL-AYN
ComodoMalware@#1s5mnx8kbmo2o
DrWebTrojan.Inject1.46088
ZillyaDropper.Injector.Win32.64493
TrendMicroTROJ_CRYPCTB.YUY
McAfee-GW-EditionRansom-FQQ!BE6285461849
SentinelOneStatic AI – Malicious PE
Trapminemalicious.high.ml.score
EmsisoftTrojan.Zbot.INE (B)
APEXMalicious
WebrootW32.Trojan.GenKD
AviraTR/Dropper.Gen
KingsoftWin32.Troj.Undef.(kcloud)
MicrosoftRansom:Win32/Critroni
GDataTrojan.Zbot.INE
AhnLab-V3Malware/Win32.Generic.C649602
VBA32TrojanDropper.Injector
ALYacTrojan.Zbot.INE
MAXmalware (ai score=100)
PandaTrj/Chgt.L
RisingTrojan.Generic/MSIL@AI.100 (RDM.MSIL:SUQZxZFOiZnGxiELK9W+XQ)
YandexTrojan.DR.Injector!j9r73+omPO4
IkarusTrojan-Dropper.Win32.Dapato
MaxSecureTrojan.Malware.300983.susgen
FortinetMSIL/GBU!tr
AVGMSIL:GenMalicious-BBG [Trj]
Cybereasonmalicious.618491
AvastMSIL:GenMalicious-BBG [Trj]

How to remove Trojan.Zbot.INE?

Trojan.Zbot.INE removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment